Uncertainty Analysis for Target SIL Determination in the Offshore Industry

Transcription

1 Uncertainty Analysis for Target SIL Determination in the Offshore Industry Sungteak Kim a*, Kwangpil Chang a, Younghun Kim a, and Eunhyun Park a a Hyundai Heavy Industries, Yongin, Korea Abstract: The requirements on design of SIS (Safety Instrumented System) based on SIL (Safety Integrity Level) has been developed continuously in the offshore industry. Especially, IEC and IEC illustrates various methodologies to determine a target SIL for specified safety function such as risk graph, hazard matrix, etc. These methods could derive different target SILs for the identical safety function. Model uncertainty might be the main cause of the result. In addition, since various methods require many input parameters, parameter uncertainties contribute to a target SIL with variance, either. In the offshore industry, engineers usually utilize two or even more methods to assess target SILs for the same function simultaneously and determine the more conservative value as the target SILs from the results. The conservatism would keep the system safe, but sometimes it could be too safe by installing excessive safety systems. For better decision-making, this article identifies the uncertainty factors in determining target SILs and evaluates the effects of the uncertainties on target SILs. Case studies have been performed for the practical systems used in the offshore industry. Keywords: SIL determination, Uncertainty analysis, Offshore industry. 1. INTRODUCTION In the offshore industry, safety instrumented systems (SIS) are installed for reducing risks to allowable level by detecting hazardous events and taking actions to prevent them from developing into further accidents. Elements of SIS consist of initiators, a logic solver, and final elements, as illustrated in Figure 1. According to the safety lifecycle approach in Figure 2, based on the international standards IEC [1] and IEC [2], the series of activities should be conducted: identifying safety instrumented functions (SIFs), assessing target safety integrity level (SIL) for each SIF, designing SIS, calculating the achieved SIL and verifying by comparison to target SIL, and putting SIS into the operation phases. Defined target SIL would affect whole SIS lifecycles including design and operation since these target values draw the upper limit of the reliability performance. From this point of view, target SIL should be derived carefully in order to not only satisfy the required risk reduction but also to get rid of unnecessary additional SISs upon existing safety systems which are already in place. Figure 1: Safety Instrumented System Initiator I Input Logic Solver O Output Final Element According to IEC [2], SIL requirement for each identified SIF would be determined using the following methods: semi-quantitative method, qualitative method, and semi-qualitative method. Choosing the proper one among the methods follows the criteria as follows: complexity, regulatory authorities, experience, accessibility of information on the input parameters, and whether the required risk reduction is given in a quantitative or qualitative form. * Contact author: sungteak.kim@gmail.com

2 Figure 2: Safety Lifecycle Approach regarding SIL SIF Identification Target SIL Determination SIS Design Modification SIL Verification Target SIL Calculated SIL? No Yes SIS Installation, Commissioning, Operation, Maintenance, and Decommissioning Abovementioned methods have both advantages and disadvantages with respect to rigor and effort, fit with SIL lifecycle, inputs required, etc. Above all, however, the methods are required to show consistency in target SIL determination. For example, if a SIF is identified from SIL workshop, the target SIL for this SIF should be the same regardless of the persons who take part in the SIL determination. Subjectivity is the main contributor of inconsistency in target SIL [3]. In practice, to avoid the problem of inconsistency, engineers and analysts usually utilize at least two methods simultaneously and apply the more conservative result as target SIL. This approach of conservatism would help the system have sufficient safeguards and keep it safe. However, there could be an argument of excessive safety system design resulting in increasing cost in terms of CAPEX as well as OPEX due to more frequent maintenance. Assessment of target SIL always involves uncertainties due to its nature decision-making based on either qualitative experts opinion or quantitative statistical data with variance. Managing these uncertainties might lead the system to be optimized via setting the appropriate level of system reliability target. Uncertainty analysis for target SIL determination would be the starting point of effective SIL lifecycle management by checking the current uncertainty level in target SIL and identifying dominant factors which contribute to output uncertainties. The objectives of this article are to (i) explain the characteristics of SIL determination methods, and (ii) propose the relevant application of the results obtained from uncertainty analysis. The article is organized as follows: introduction of methods for target SIL determination, which are popular in the offshore industry in Section 2, identification of uncertainty factors and applicable proposed procedures for uncertainty analysis in SIL determination phase in Section 3, case studies performed to show the effects of the uncertainty analysis in Section 4, and conclusion with some future works in Section 5.

3 2. TARGET SIL DETERMINATION FREQUENTLY USED IN THE OFFSHORE INDUSTRY 2.1. Risk Graph Risk graph is the one of popular methods used for target SIL determination in the offshore industry. Hazard matrix, another frequently used one, is known as the similar method to the risk graph. The common thing of two methods is that some parameters are combined to present the level of unmitigated risks based on decisions made by experts. However, the risk graphs consider likelihood (or demand rate), consequence, occupancy and probability of personnel avoiding hazard while the hazard matrices consider only likelihood and consequence [4]. This means that the risk graphs enable engineers to model more detailed situation. Still, the risk graph method has a limitation. The method is suitable for assessing target SIL of SIS with defined equipment under control (EUC), for instance a pressure vessel, which is defined as local safety functions. On the other hand, safety functions where the whole platform is the EUC, e.g. emergency shutdown and fire & gas safety functions, defined as global safety functions, are not easily assessed through risk graphs [3] Minimum SIL Requirements in OLF 070 Since IEC and IEC provide a variety of methods for SIL requirement determination, but without the specified guideline of which method to be used, it is difficult to choose the proper method. Additionally, it is known that the risk graphs and/or hazard matrices can result in non-consistent SIL requirement [3]. In this respect, OLF 070 suggests the use of minimum SIL requirements for target SIL. Minimum SIL requirements are developed for the most typically used safety functions in the oil and gas production plants. The table 7.1 in OLF 070 [3] contains the description of each safety function, functional boundaries and minimum SIL requirements. The goal of the minimum SIL requirements is for checking the minimum safety level of frequently used safety functions, simplifying calculation and documentation, and thus encouraging the standardization of target SIL determination in the industries [4]. Minimum SIL requirements are based on the typical loop assumption and estimated using the industrially verified component reliability data. Since the minimum SIL values are literally the minimum requirements, it is possible to establish stricter requirements where overall risk levels are much higher, which result from quantitative risk assessment (QRA) using the minimum SIL values as input data. However, because of plant specific conditions and technological improvements, deviations from the defined minimum SIL requirements may be identified. To handle the deviations, OLF 070 Appendix C [3] suggests compensating methods using the tabulated minimum SIL requirements, whereas practical oil and gas projects go back to the original approach using IEC and IEC methodologies [4]. 3. UNCERTAINTY ANALYSIS IN DETERMINING TARGET SIL 3.1. Concept of Uncertainty Uncertainty is incomplete knowledge and information about a system as well as inaccuracy of the behaviour of systems [5]. Based on its nature, uncertainty is classified into two categories; epistemic or aleatory uncertainty. Epistemic uncertainty stems from the lack of knowledge. Accordingly, this kind of uncertainty can be reduced or controlled if additional knowledge becomes available. Aleatory uncertainty arises from inherent and natural randomness and variability. In this respect, aleatory

4 uncertainty may be associated with observable quantities while epistemic uncertainty with unobservable quantities such as a failure rate [6]. In practice, a system cannot be characterized exactly due to epistemic uncertainties in both values of the model parameters and assumptions supporting the model itself [7]. The former and the latter are called parameter uncertainty and model uncertainty, respectively. An uncertainty analysis aims at identifying uncertainty factors and presenting uncertainties in analysis results for better decision making in terms of parameter and model uncertainty Parameter Uncertainty Parameter uncertainty is about uncertainty in quantitative parameter values [5]. In this paper, concerning parameters are failure rates of components, beta-factors for common cause failure, proof or diagnostic test coverage factors, etc. Main influencing factors to parameter uncertainty are relevance and amount of generic data for a specific application and environment. In terms of epistemic or aleatory uncertainty, parameter uncertainty can be deemed epistemic, aleatory, or both [10]. Regarding epistemic uncertainty, parameter uncertainty comes from imperfect knowledge about distribution types and values of the parameters. For aleatory uncertainty, the distribution of parameters represents its inherent variability. In the same context, the distribution includes combined effect of aleatory and epistemic uncertainty. The effect of parameter uncertainty can be analyzed by observing uncertainty propagation [8]. Uncertainty propagation results in the distribution of uncertainty measures of interest (in our case, average of PFD or SIL). The techniques used for uncertainty propagation are Monte Carlo simulation, moment propagation, or discrete probability distribution [9]. It is recommended that sensitive analysis can be utilized to rank the importance of parameters in addition to uncertainty propagation [6] Model Uncertainty Model uncertainty mainly concerns the validity of model assumptions [11]. A model is the interpretation of real world. To design and develop a model, a lot of assumptions and hypotheses have to be defined. Even if these assumptions are well-defined logically, validation should be taken into account in order to check how much the model reflects real world. Moreover, selection of models contributes to model uncertainty. Since the interpretations can vary, it is necessary that the models have gaps. Various models show the differences especially in the number and the kind of parameters used. Model selection is also influenced by regulations, standards, guidelines, and internal company policies. Further, the more the model deals with detailed level, the much time and effort are needed [11]. Assuming that the models have similar level of validity, model uncertainty can be reviewed by comparing the results of various models. However, it is sometimes hard to decide which model should be selected for the analysis where validation cannot be performed. In this case, a consensus model [8], which has been publicly published, peer reviewed, and widely adopted by stakeholders, is recommended to be used Uncertainty Analysis for Target SIL Determination Technically, there are two representative methods for analysis of uncertainty, fuzzy set approach and probabilistic approach [12]. The fuzzy set approach is a set of mathematical principles for knowledge representation as degrees of belief using membership functions. It reflects how people think and attempts to model sense of words and intent of decision making [13]. The structure of a fuzzy set approach consists of three main components: a fuzzifier, which converts parameters into membership functions; an inference engine, based on a set of rules that reflects experts opinions about how to link

5 input to output; and a defuzzifier that re-convert the obtained output parameters into scalar value, in this case the target SILs. Probabilistic uncertainty analysis is mainly based on sampling techniques: Monte Carlo sampling or Latin Hypercube sampling [12]. These methods generally involve the generation of random samples of input random variables, the deterministic evaluations of the performance function at these samples, and the post-processing to extract the probabilistic characteristic (statistical moments, reliability, and PDF) of the performance function. Considering qualitative features of the risk graph methodology into uncertainty modeling, the fuzzy set approach should be utilized since experts knowledge and consensus are key factors for target SIL determination [14]. On the other hand, sampling-based method is applicable to quantitative SIL determination methods such as OLF 070 minimum SIL requirement. Input parameters can be modeled as assumed probability distributions and this makes the basis of sampling technique. 4. CASE STUDIES 4.1. System Description An example study has been illustrated for the local safety function, MEG Subsea Injection Pump Discharge PSHH. This protection function is to prevent overpressure in discharge of MEG injection pump, which is positive displacement type. Any obstruction at the user point or no MEG injection due to process shutdown might lead to this hazard. To prevent this hazard, MEG injection pump should be stopped on high-high pressure detected at the pump discharge. There will be not only MEG spill as an environmental consequence but loss of containment with very high pressure in terms of personnel risk. The dangerous undetected failure includes all possible modes of failure leading to any of the following effects: the transmitter failing to signal high pressure on demand, the logic solver failing to initiate pump stop, the circuit breaker failing to stop the pump motor on demand. For this reason, the MEG pump is not included in the reliability calculation. Figure 3 shows the configuration of this SIF. Figure 3: MEG Subsea Injection Pump Discharge PSHH Configuration It is assumed that there are already existing protective measures, so-called non-sis. One measure is two pressure safety valves (PSVs) provided on the MEG injection pump discharge, sized for blocked outlet condition. Another is the valve that will be open to maintain the pressure in the header. However, if obstruction is sudden, pressure control may not act Effects of the Uncertainties on Target SIL Target SIL obtained from risk graph using fuzzy set approach To investigate the effects of the uncertainties on determined target SIL, uncertainty analysis, using either fuzzy set approach or sampling-based method, has been performed for two different SIL determination methods; risk graph and OLF 070 minimum SIL requirement. Previously, in section 3.4, the fuzzy set approach is appropriate for uncertainty analysis of risk graph model. For this case study, the calibrated risk graph has been used as shown in Figure 4, which conveys the result of SIL assessment for the SIF in deterministic way. The first step of the fuzzy set approach is to fuzzify the parameters into membership functions. Parameters used here are listed in

6 Figure 5 with corresponding membership functions, respectively. Membership functions are modelled using both trapezoidal and triangular shaped functions. For parameter P, the mark with a star indicates as follows: P A should be selected if only all the following are true; a) facilities are provided to alert the operator that the SIS has failed, b) independent facilities are provided to shutdown such that the hazard can be avoided or which enable all persons to escape to a safe area, c) the time between the operator being alerted and a hazardous event occurring exceeds 1 hour or is definitely sufficient for the necessary actions. After the fuzzification, the fuzzy inference system is modelled using If-then rule, for example, If (C is Medium_high) and (F is Low) and (P is High) and (W is Medium_high) then (SIL is SIL 2). In this case study, total 52 rules are generated. The last stage is to defuzzify the results obtained back into the scalar value. There are several methods of defuzzification such as Center-of-Maximum (CoM), Mean-of-Maximum (MoM), Center-of-Area (CoA), etc. For this case, CoA has been used because this method can produce more accurate results [15] and the result is shown in Figure 6. Figure 4: Calibrated Risk Graph and Determined Target SIL for the SIF

7 Figure 5: Membership Functions for Risk Graph Parameters

8 Figure 6: Target SIL Obtained using the Fuzzy Set Approach Target SIL obtained from OLF 070 minimum SIL requirement using sampling method As mentioned in section 2.2, minimum SIL requirements in OLF 070 are derived based on the typical loop assumption and PFD estimation using industrially verified component reliability data. Thus, the uncertainty analysis, applied to determination of target SIL using the method from OLF 070, would be performed by the sampling methods to investigate the effect of uncertainty propagation. To calculate the target SIL of the SIF, PDS method [16] has been used for maintaining consistency with OLF 070. Since every component has simple configuration, 1oo1, the average of PFD follows the formula (1) without consideration of common cause failure. It should be noted that the probability of so-called test independent failure (TIF) can be added to the PFD to reflect the effect of incomplete testing. OLF 070 takes P TIF into consideration when calculating PFD. The values for P TIF come from the PDS data handbook [17]. PFD A = λ DU τ/2 + P TIF (1) In addition to the abovementioned model (1), another model has been used in the case study for the purpose of comparison. In order to replace the effect of imperfect testing with P TIF, proof test coverage (PTC) is added to the input parameters [16] and the PFD model is modified as follows: PFD B = PTC λ DU τ/2 + (1 PTC) λ DU T/2 (2) T is the assumed interval of complete testing that the residual failure modes will be detected. If some failure modes are not able to be tested for, then T should be taken as the lifetime of the equipment. In this case, T is assumed to be 5 years, the periodic overhaul duration of the offshore plant where the SIF would be installed. Table 1 shows the reliability data used for the calculation of minimum SIL requirement of the SIF. Among the parameters, λ DU and PTC are assumed to be random variables due to uncertainties from incompleteness of data. The uncertainty of the DU failure rate is given by a lognormal distribution with median equal to the values in Table 1. The error factors are assumed to be 3 [11]. The PTC and P TIF are given by a uniform distribution with the intervals shown in Table 1. In regard to proof test coverage, this assumption is due to lack of accumulated data from generic databases in the offshore industry. Also, P TIF has certain amount of uncertainty because its value is determined by experts opinion. On the other hand, number of components and τ are assumed to be constant since the uncertainties of configurations and proof test intervals can be controlled [8]. Table 1: Reliability Data for the SIF Components Component No. of λ DU τ PTC Components (/hour) (hours) (%) P TIF Pressure transmitter ~ ~ Logic solver ~ ~ Circuit breaker ~ ~

9 The uncertainty propagation has been studied by Monte Carlo simulation. For each simulation run, random values for each uncertain parameter have been obtained and then used as an input to calculate target SIL A and SIL B based on PFD A and PFD B, respectively. 50,000 simulation runs are performed for the precision of results. The target SIL distributions are shown in Figure 7 with input parameter distributions. Also, the statistics of target SIL simulation results are arranged in Table 2, where P α represents α% percentile of each output value. Figure 7: Target SIL Distribution using Monte Carlo Simulation Table 2: Statistics of Target SIL Simulation Results Output Mean Standard Coefficient of Deviation Variation P 10 P 50 P 90 PFD A 9.94 x x x x x x 10-2 PFD B 1.27 x x x x x x 10-2 SIL A x x SIL B x x

10 4.3. Discussions Without any uncertainty taken into consideration, i.e. in deterministic way, SIL 2 requirement has been derived when using calibrated risk graph as shown in Figure 4. Moreover, OLF 070 [3] refers that the PSD function for PAHH is required to satisfy SIL 2. The function is defined to start with the pressure sensor and terminates with closing of the critical valve. On the minimum SIL table, it is noted that the final element of this function could be different from a valve, e.g. a pump which must be stopped. From the viewpoint of OLF 070, MEG Subsea Injection Pump Discharge PSHH is also classified in the PSD function for PAHH and SIL 2 requirement can be applied. Unlike the target SILs determined by deterministic way, the results show differences when considering underlying uncertainties together. For the same SIF, the fuzzy risk graph result and sampling-based PFD A show similar tendency that SIL 2 is dominant than SIL 1. However, sampling-based PFD B results in SIL 1 as a target SIL since the mean value of PFD is slightly over the 1.00 x 10-2, which is the boundary of SIL 1 and SIL 2. Although the distributions of PFD A and PFD B approximate each other in terms of both location of center and amount of relative variation, the final outputs are distinguished. It can be guessed that the reason of the difference in target SILs mainly comes from the difference in models between PFD A and PFD B. Since PTC shows much sensitivity than other parameters [4], the PFD B model including PTC can be vulnerable to the parameter uncertainty. Even if P TIF is exposed to a certain level of uncertainties since the values are general based on expert judgment [16], trustworthy and reliable database dealing with PTC does not exist yet. Thus, as of now, PFD A model has much, even a little, robustness that PFD B model. The fuzzy risk graph, in Figure 6, shows that target SIL values range from SIL 1 to SIL 3. It is not necessary to take the result into account seriously because the portion of SIL 3 is small, 7% of all results. However, a situation is likely to occur when there is no dominant target SIL value. For instance, target SIL results have values from SIL 1 to SIL 3 with relative frequencies of 35%, 35%, 30%, respectively. In this case, some decision-makers can think and act cautiously by choosing SIL 3 as the target SIL. Still, other decision-makers consider the result as the average of PFD or SIL. From this point of view, SIL 2 is determined since the median and/or mean value is located in SIL 2 range. It is not easy to judge which decision is more reasonable. The same problem can also occur when using sampling-based method. 5. CONCLUSION This article has given overall understandings of uncertainty analysis for target SIL determination phase. Especially, risk graph method and minimum SIL requirement in OLF 070 have been introduced and studied as subjects for uncertainty analysis since these are popular methods in offshore industry. Both model and parameter uncertainty contribute to uncertainties of determined target SIL values when using either risk graph or minimum SIL requirement. To investigate the effect of uncertainties, the fuzzy set approach and sampling-based simulation have been used for risk graph and OLF 070 minimum SIL requirement, respectively. The case studies have been performed on the SIF, MEG subsea injection pump discharge PSHH. When applying deterministic approach, SIL 2 is derived as the target SIL by risk graph and OLF 070 minimum SIL requirement. Similarly, the fuzzy set approach and the sampling-based method for PFD A model show the same result, SIL 2 on average. PFD B model, however, shows the difference which results in SIL 1. The main reason was due to the high sensitivity parameter, PTC. In conclusion, uncertainty analysis can provide broader possibility of having various output values when determining target SIL. When making decisions on target SILs based on the results obtained from the uncertainty analysis, balance is the most considerable issue between sufficient safety margins and economic feasibility.

11 Acknowledgements This work was supported by the Korea Evaluation Institute of Industrial Technology ( , Development of 500 MPa URF & SIL 3 Manifold and Subsea System Engineering for Deepsea Field) funded by the Ministry of Trade, Industry & Energy (MI, Korea). References [1] IEC Functional safety of electrical / electronic / programmable electronic safetyrelated systems, International Electrotechnical Commission, 2010, Geneva. [2] IEC Functional safety safety instrumented systems for the process industry, International Electrotechnical Commission, 2010, Geneva. [3] OLF-070. Application of IEC and IEC in the Norwegian petroleum industry, Technical report. The Norwegian Oil Industry Association, 2004, Stavanger, Norway. [4] S. Kim, K. Chang, and Y. Kim. Risk-based design for implementation of SIS functional safety in the offshore industry, In: Steenbergen RDJM, van Gelder PHAJM, Miraglia S, Vrouwenvelder ACWM, editors. Amsterdam, The Netherlands, 29 September-2 October 2013 Safety, reliability and risk analysis: Beyond the horizon. Proceedings of the European safety and reliability conference 2013 (ESREL 2013), CRC Press, pp , (2013), London. [5] M. Rausand. Reliability of safety-critical systems, John Wiley & Sons, Inc., 2014, Hoboken, New Jersey. [6] M.A. Lundteigen. Safety instrumented systems in the oil and gas industry: concepts and methods for safety and reliability assessments in design and operation, Doctoral thesis, Norwegian University of Science and Technology (NTNU), 2009, Trondheim, Norway. [7] T. Aven and E. Zio. Some considerations on the treatment of uncertainties in risk assessment for practical decision making, The Journal of Reliability Engineering and System Safety, volume 96, pp.64-74, (2011). [8] H. Jin, M.A. Lundteigen, and M. Rausand. Uncertainty assessment of reliability estimates for safety instrumented systems, In: Berenguer C, Grall A, Guedes Soares C, editors. Troyes, France, September 2011 Advances in safety, reliability and risk management. Proceedings of the European safety and reliability conference 2011 (ESREL 2011), CRC Press, pp , (2011), London. [9] NASA, Probabilistic risk assessment procedures guide for NASA managers and practitioners, Technical report, NASA Office of Safety and Mission Assurance, 2002, Washington, DC. [10] Abrahamsson, M. Uncertainty in quantitative risk analysis characterization and methods of treatment, Doctoral thesis, Lund University, 2002, Lund, Sweden. [11] A.F. Janbu. Treatment of uncertainties in reliability assessment of safety instrumented systems, Master s thesis, Norwegian University of Science and Technology (NTNU), 2009, Trondheim, Norway. [12] G. Rausand. Uncertainty management in reliability analyses, Master s thesis. Norwegian University of Science and Technology (NTNU), 2005, Trondheim, Norway. [13] O.Y. Abul-Haggag, and W. Barakat. Application of fuzzy logic for the determination of safety integrity in light of IEC & standards, International Journal of Emerging Technology and Advanced Engineering, volume 3, pp.41-48, (2013). [14] C. Simon, M. Sallak, and J.F. Aubry. SIL allocation of SIS by aggregation of experts opinions, Proceedings of the European safety and reliability conference 2007 (ESREL 2007), 2007, Stavanger, Norway. [15] I. Elaamvazuthi, P. Vasant, and J. Webb, The application of Mamdani fuzzy model for auto zoom function of a digital camera, International Journal of Computer Science and Information Security, volume 6, pp , (2009). [16] Sintef. Reliability prediction methods for safety instrumented systems, PDS method handbook, Sintef, 2013, Trondheim, Norway. [17] Sintef. Reliability data for safety instrumented systems, PDS data handbook, Sintef, 2013, Trondheim, Norway.